I have an issue. The address for a function that I need to overwrite the RET to (buffer overflow) is only 3 bytes. However, I need 4 bytes to overwrite the RET exactly. What do I do?

  • 3
    erm, set the highest byte to zero? I'm not sure if i understand your question correctly, though, one or two more sentences would help. Jun 14, 2015 at 8:12

1 Answer 1


If the architecture is 32-bit, every address must be 4 bytes so the function address you mentioned is not exception. but as high order 00 is not valuable (in math) it is not normally mentioned:

0x0041a82f --> 0x41a82f

You must overwrite your address in 4 bytes with former 00. but in many cases (especially string base overflow) it is a problem called "bad char", cause payload corruption. you have to fix this problem too. Good Luck!

  • Yep I'm facing the problem you mentioned now :) Jun 18, 2015 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.